IGGY
No Guru Just Here To Help
Premium,MVM
join:2001-03-30
Chatham, IL
| reply to xxx xxx
Re: Privacy in the new ZoneAlarm 5.5
Answer to A should be no. A trial version would be a trial copy of a pay for product. Such as ZAP, ZA Suite or IM Secure Pro. B -Is this new anonymous sending feature in ZAF 5.5.062.000? As far as I know this has been an option for many builds now. Again during install you should see the question asked. And you should be able to enable or disable this.
C) If this feature is included do I have a choice in allowing or preventing ZAF from sending any anonymous secure community data to Zone Labs.
I think my answer to B covers this. As does my first reply above. I'm having a feeling this is going to get blown way out proportion. Nothing evil is going on here. I've included a screen capture of the screen you should see during install. I'm under the impression that all versions have this screen during install.
--
Test Your Security Benefit for Children's Cancer Cable Diagnostics My Blog |
|
spooler
@cableone.net
| Re: iggy's prior post explains some of this
iggy said;
"you should be able to enable or disable this" (i.e., the feature where ZA communicates with ZoneLabs).
--------------------
But the first thing ZA does without asking is contact ZoneLabs for one or more of various reasons. . .
See the explanation at:
»Why Zone Labs software contacts Zone Labs
Is this a bad thing? - probably not.
Should it stop one from using ZoneAlarm free or pro? - probably not,
assuming it is the user's firewall of choice in the first place. |
|
xxx xxx
@telus.net
|  Iggy, thanks for your fast response to this ZAF privacy concern. As mentioned earlier, I’ve been a ZAF user for many years and my only goal here is just to be clear on this issue.
I never noticed this EXCEPTION link in ZAF prior to Charles770 mentioning it yesterday. I guess I just never zeroed in on it before. I did check with a colleague who’s running ZAF 5.1.033.000 and yes it’s there. 
Just to make sure I didn’t miss something yesterday, this morning I did an uninstall & a clean ZAF install. The SET DATA GATHERING PERMISSIONS screen doesn’t seem to be an option when installing ZAF on my system.
Here’s my questions to the ZA community:
A) When you installed ZAF (Free not Pro) did you see this screen as an option?
B) Is this anonymous sending feature in ZAF 5.5.062.000?
C) If yes, how does one disable it and prevent it from sending any anonymous data to Zone Labs?
I appologize if I’m being overly anal and hopefully I’m about to answer my own questions here. It does state in the Help section under “Sharing your settings with Zone Labs” …“Configuration data is not collected from ZoneAlarm or ZoneAlarm with Antivirus users.” Can we safely interpet this to mean that ZAF (Free) does not transmit anonymous configuration data or for that matter any type of anonymous data and that’s why we do not see the SET DATA GATHERING PERMISSIONS screen & check box option when installing? 
Best regards,
Marsman  |
|
Charles770
join:2004-11-08
France
1 edit | reply to IGGY
Re: Privacy in the new ZoneAlarm 5.5
Thanks everyone for reply.:)
Sorry Iggy, but I didn't had such a screen during install (Win98 SE), and never had it for a previous version.
As it's said: "This option *does not appear* in trial versions of Zone Labs security software.", which seems to be ZAF definitely.
From Help:
Even with the "Alert me before I make contact" preference selected in the Overview|Preferences tab, you will not be alerted before sending configuration data to Zone Labs.
... The frequency of data transmission depends upon the configuration of your computer. For most users, data will be sent once per day.
To be very clear, does ZoneAlarm free has became a Spyware?
Regards.;)
Charles. |
|
IGGY
No Guru Just Here To Help
Premium,MVM
join:2001-03-30
Chatham, IL
2 edits | reply to spooler
Re: iggy's prior post explains some of this
"But the first thing ZA does without asking is contact ZoneLabs for one or more of various reasons"
This action would of course be blocked when set to be blocked. I have no such contact with the company when using their product.
Now if users aren't seeing the option screen I captured during the install. That leads me to have to send an email and start asking some questions. Which I'll do when I get time later tonight. I'm not ready to call out the wolves just yet.
From the link that was provided ( this is also in my ZoneLabs published bookmarks ).
"Of course, this communication is done on an "opt in" basis; it is your choice to decide to take advance of these features and services."
"Here's the link that said it would happen"
What was posted above was taken from your link to my post in the vendors forum.
--
Test Your Security
Benefit for Children's Cancer
Cable Diagnostics
My Blog |
|
spooler
@cableone.net
| Re: what's missing here?
Iggy said:
"But the first thing ZA does without asking is contact ZoneLabs for one or more of various reasons"
This action would of course be blocked when set to be blocked.
-------------------
But here's what happens on my system at every startup.
First thing out of the box, ZA contacts zone labs at one or more of the sites mentioned in your earlier post explaining that is what happens. [See capture of router log traffic]
Here's the link that said it would happen:
»Why Zone Labs software contacts Zone Labs
Interesting thing is that no alert pops up and no entry appears in the ZoneAlarm logs. [See capture of blank ZA log page]
More interesting is the program settings where the ZAClient is blocked all accross the board. [See capture of it in next post]
Also interesting is the fact that the first ZA status page is set for ZA not to contact ZoneLabs without first alerting the user and asking for permission. [See capture in next post]
There may be an explanation . . .
Does it stop me from using ZA? - no.
Does it make me wonder why ZA works this way? - yes. |
|
spooler
@cableone.net
| reply to IGGY
Re: second two captures from above post
Here are the last two captures mentioned in first post. |
|
Infoman1
join:2001-03-21
Hubbard, OH
| reply to spooler
Re: iggy's prior post explains some of this
With respect to the opt in or out, Zone Alarm periodically sends data back on a routine basis. (PA2.zonelabs.com) Looking at an Ethereal trace, part of the communication is encrypted. Could this be the license key? When I caught it I was personally uncomfortable with it, so some explanation is needed. |
|
spooler
@134.50.x.x
| Outbound traffic from Zone Alarm
Informan1 said:
"...Zone Alarm periodically sends data back on a routine basis....part of the communication is encrypted....Could this be the license key? ...I(i.e., Informan1) was personally uncomfortable with it, so some explanation is needed."
-------------------
Sorry that answer is way over my head. I personally do not believe it is sinister, but it appears to me that ZoneLabs needs to revise its disclosure of what information is sent and when.
It would also be nice if the company did not send information back out without giving users the choice to allow or disallow those communications. If you are using ZA Pro, you may be able to create an "expert rule" to block some of those outgoing messages, but maybe not....
We'll have to depend on Iggy and the other ZA team members here to get in touch with the company and let us know for sure. |
|
IGGY
No Guru Just Here To Help
Premium,MVM
join:2001-03-30
Chatham, IL
| Iggy hasn't heard back from ZoneLabs yet. I need to do some catching up on the post in this thread. But I've been up for about 25 and 1/2 hours now. Just back from a cancer research benefit. The 2 Red Bulls are wearing off.:) So I'll have to get to this tomorrow evening or Monday morning.
--
Test Your Security Benefit for Children's Cancer Cable Diagnostics My Blog |
|
SUMware
Premium
join:2002-05-21 | Thank you Iggy. We appreciate your efforts and understand that you have a life outside of here. LOL. No problem! |
|
Charles770
join:2004-11-08
France | reply to IGGY
Thanks a lot Iggy.
We know that you do your best, when we need a help! |
|
spooler
@134.50.x.x
| reply to SUMware
second that thanks to Iggy.
Sumware and Charles said to Iggy:
Thank you Iggy. We appreciate your efforts and understand that you have a life outside of here. LOL. No problem!:)
Thanks a lot Iggy.
We know that you do your best, when we need a help!:)
----------------
Second that from here, too. Thanks for all your help, Iggy.:D |
|
Snakebytes
| reply to spooler
Re: what's missing here?
Thanks Spooler,
I will be re-thinking if I should renew my subscription to ZoneAlarm Pro. It is due soon.
I dont like these kind of backdoor surprises. Certainly dont want to be paying money for them. |
|
Infoman1
join:2001-03-21
Hubbard, OH | reply to IGGY
Re: Outbound traffic from Zone Alarm
Thanks for your effort. Just want to know why exactly this application is phoning home. It happens on every machine Zone Alarm is installed on. I can provide the Ethereal dump if you like, although unlikely needed. |
|
VirtualLarry
Premium
join:2003-08-01
| reply to Charles770
Re: Privacy in the new ZoneAlarm 5.5
said by Charles770  :To be very clear, does ZoneAlarm free has became a Spyware? A long, long time ago. Isn't this common knowledge? |
|
VirtualLarry
Premium
join:2003-08-01
| reply to IGGY
Re: iggy's prior post explains some of this
said by IGGY :"But the first thing ZA does without asking is contact ZoneLabs for one or more of various reasons" This action would of course be blocked when set to be blocked. I have no such contact with the company when using their product. Just a minor note here. I have no idea how it behaves in the 5.x Free versions, but in the prior 3.x versions, attempting to "block" ZA from phoning-home, using the firewall's own controls, was ineffective. It had an internal "allow" rule to bypass any user rules. If ZA Free 5.x is phoning home again, then I also have no doubt that they would also use a similar inbuilt "allow" bypass rule.
I don't know if I have it saved, but I had a really good discussion about this whole issue when it first broke out with one of ZL's official free-support people on GRC's newsgroups. They confirmed the behavior, and that it was intentional, for marketing reasons. Think about it, it tells them how many people, worldwide, happen to be use the "free" version of their software, and allows them a marketing opportunity to "upsell" them to the paid version. There was also some comment about auto-upgrade patches being detected, in case there is a flaw in the software, but that doesn't explain why the software generated a unique user-id, nor why it didn't give the users of the free version the opportunity to opt-out of it.
said by IGGY :Now if users aren't seeing the option screen I captured during the install. That leads me to have to send an email and start asking some questions. Which I'll do when I get time later tonight. I'm not ready to call out the wolves just yet. Well, knowing that they've done it before, it wouldn't surprise me one bit to see them trying it again.
It really calls into the question of whether or not you can trust the vendor of your security software, when their software intentionally undermines the ability of the user to specify security policy. I am, in fact, no longer a ZoneAlarm user directly because of that, and because of recurring technical flaws in their software. |
|
Infoman1
join:2001-03-21
Hubbard, OH
| To be clear and factual. While these options are present in fully licensed purchased copies of ZA Pro of which I have disabled. Bottom line is free version or purchased; the product phones home and there is no way to prevent it within it's own software! |
|
IGGY
No Guru Just Here To Help
Premium,MVM
join:2001-03-30
Chatham, IL
4 edits | reply to IGGY
Re: Outbound traffic from Zone Alarm
I've still not heard back from ZoneLabs in regards to this thread. I just dropped a quick post on blog in regards to that. I've not forgotten about the thread. I'm going to try and do a read of recent post tonight. This thread is also now listed on my ZoneLabs bookmark page. Which I think at least one person from the company checks out from time to time.
Although I understand why users would be concerned about privacy. I think this is a bit over the top.
"I am not concerned about ZL privacy policy but I am concerned about embedded code tracking whatever. (AKA spyware)."
Your not going to see a reputable company all of a sudden start dropping spyware into their product. Even if they gave it a thought. Most companies are smart enough to realize the down side of this. They know in the end there is no positive upside long term wise. Yes many companies who "fight" ( term used loosely ) spyware - have used some "interesting" tactics to get you to buy their product. But I just don't see ZoneLabs doing something that underhanded. They have always stated that the free ZoneAlarm would be adware and spyware free. I think sometimes we are to quick to assume the worst.
"Maybe ZA uses the servers of Cerberian Inc."
This is in relation to the web filtering option. Or what some would call parental controls. I wouldn't think that ZA Free would have anything in relation to this. Considering that isn't a feature offered in the free version of the product. I do see some users are claiming to have found a related file in free above. My only thought would that since all versions are now running on the same code base - being updated at the same time - instead of one at a time. The file may have something to do with that.
Just sent in another email. With quick details of the latest concerns expressed here.
--
Test Your Security
Cable Diagnostics
Iggyz Blog ZoneAlarm Help |
|
spooler0
Premium
join:2004-11-17
| Thank you for checking, Iggy.
While at it, would you confirm what the h2.zonelabs.com contacts are? It appears to me that h2.zonelabs.com may also be used as part of the virus updates checking feature, but the information on link I have for your post describing that doesn't mention it in connection with h2.zonelabs.com.
Either way, it would be good to know. |
|
